File name:

#!!SetUp_4433_Pa$WorD!.zip

Full analysis: https://app.any.run/tasks/b7362edf-d1a2-493d-9379-6df3f7f793d8
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: October 31, 2024, 13:13:11
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
lumma
amadey
botnet
golang
crypto-regex
rdp
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

BD59FC3D48FB364167544C5DC6619E78

SHA1:

4140B630A245BC844C8B393F703546E3F076117C

SHA256:

01BE1D48F82E7DBF0D55C387134980748F2A871B004AB39D63D7DB775E0C1577

SSDEEP:

98304:Gt/a4YZDhTADh7bbMYIleaaAG6Zdt+NoUZJ0NRoYm+jTDct1Y7emeFiuasHUc5pd:CHcJtGfdj2NbF7/m1ecDz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Stealers network behavior

      • svchost.exe (PID: 2172)
    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6960)
    • Changes powershell execution policy (Bypass)

      • OpenWith.exe (PID: 6420)
    • LUMMA has been detected (YARA)

      • OpenWith.exe (PID: 6420)
    • AMADEY has been detected (YARA)

      • explorer.exe (PID: 6704)
    • Connects to the CnC server

      • explorer.exe (PID: 6704)
    • AMADEY has been detected (SURICATA)

      • explorer.exe (PID: 6704)
    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2172)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 6344)
      • WinRAR.exe (PID: 1732)
      • Set-up.exe (PID: 1784)
    • Starts a Microsoft application from unusual location

      • Set-up.exe (PID: 1784)
    • The process drops C-runtime libraries

      • Set-up.exe (PID: 1784)
    • Node.exe was dropped

      • OpenWith.exe (PID: 6420)
    • Executable content was dropped or overwritten

      • Set-up.exe (PID: 1784)
      • AutoIt3.exe (PID: 6612)
      • OpenWith.exe (PID: 6420)
    • The process executes Powershell scripts

      • OpenWith.exe (PID: 6420)
    • Starts application with an unusual extension

      • Set-up.exe (PID: 1784)
    • Starts POWERSHELL.EXE for commands execution

      • OpenWith.exe (PID: 6420)
    • Connects to unusual port

      • MicrosoftEdgeUpdateCore.exe (PID: 608)
    • There is functionality for enable RDP (YARA)

      • explorer.exe (PID: 6704)
    • Found regular expressions for crypto-addresses (YARA)

      • MicrosoftEdgeUpdateCore.exe (PID: 608)
    • Contacting a server suspected of hosting an CnC

      • explorer.exe (PID: 6704)
      • svchost.exe (PID: 2172)
  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 1732)
    • Manual execution by a user

      • WinRAR.exe (PID: 1732)
      • Set-up.exe (PID: 1784)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1732)
    • Application based on Golang

      • MicrosoftEdgeUpdateCore.exe (PID: 608)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Amadey

(PID) Process(6704) explorer.exe
C2moviecentral-petparade.com
Strings (129)Kaspersky Lab
ProductName
------
POST
ESET
random
bi:
0000043f
S-%lu-
moviecentral-petparade.com
Doctor Web
GET
Bitdefender
moviecentral-petparade2.com
-unicode-
#
ar:
/Plugins/
cred.dll
VideoID
/quiet
wb
/g9jvjfd73/index.php
e3
&&
Powershell.exe
"
00000422
\
cmd /C RMDIR /s/q
00000423
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
a6c6395115
un:
cred.dll|clip.dll|
e2
moviecentral-petparade3.com
Programs
msi
av:
r=
/8bkjdSdfjCe/index.php
DefaultSettings.YResolution
AVG
dm:
rb
Panda Security
" && timeout 1 && del
Main
zip
5.03
SOFTWARE\Microsoft\Windows NT\CurrentVersion
%-lu
Norton
e1
Comodo
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
2016
CurrentBuild
Sophos
<d>
ComputerName
pc:
GetNativeSystemInfo
abcdefghijklmnopqrstuvwxyz0123456789-_
d1
lv:
AVAST Software
:::
Rem
exe
|
vs:
--
https://
WinDefender
st=s
&unit=
Startup
=
kernel32.dll
ProgramData\
rundll32.exe
id:
sd:
" && ren
Keyboard Layout\Preload
00000419
/k
.jpg
+++
-executionpolicy remotesigned -File "
"taskkill /f /im "
cmd
?scr=1
360TotalSecurity
0123456789
dll
shell32.dll
Content-Type: multipart/form-data; boundary=----
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Content-Disposition: form-data; name="data"; filename="
-%lu
------
\0000
ps1
Avira
clip.dll
2019
&& Exit"
rundll32
SYSTEM\ControlSet001\Services\BasicDisplay\Video
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
\App
http://
%USERPROFILE%
shutdown -s -t 0
" Content-Type: application/octet-stream
Content-Type: application/x-www-form-urlencoded
/g9jvjfd74/index.php
Gxtuum.exe
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
og:
<c>
DefaultSettings.XResolution
os:
2025
2022
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:10:30 14:17:06
ZipCRC: 0x5bca7345
ZipCompressedSize: 1069200
ZipUncompressedSize: 1126214
ZipFileName: aktfh
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
19
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe rundll32.exe no specs set-up.exe nc.exe no specs icacls.exe no specs conhost.exe no specs more.com no specs conhost.exe no specs #LUMMA openwith.exe #LUMMA svchost.exe bguo31blg4wqaox9ma4vf71oj1m.exe no specs powershell.exe no specs conhost.exe no specs comp.exe no specs conhost.exe no specs autoit3.exe THREAT microsoftedgeupdatecore.exe #AMADEY explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
608C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exeC:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe
AutoIt3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.185.17
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\1.3.185.17\microsoftedgeupdatecore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
1732"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\#!!SetUp_4433_Pa$WorD!.zip" "?\"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1784"C:\Users\admin\Desktop\#!!SetUp_4433_Pa$WorD!\Set-up.exe" C:\Users\admin\Desktop\#!!SetUp_4433_Pa$WorD!\Set-up.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Live Messenger
Exit code:
1
Version:
8.5.1235.0517
Modules
Images
c:\users\admin\desktop\#!!setup_4433_pa$word!\set-up.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2172C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2928C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3568\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execomp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4040\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exemore.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4436C:\WINDOWS\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\System32\icacls.exenc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5580\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6228\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeicacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
14 515
Read events
14 479
Write events
23
Delete events
13

Modification events

(PID) Process:(6344) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6344) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6344) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
(PID) Process:(6344) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6344) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6344) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6344) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6344) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_0
Value:
4C000000730100000402000000000000F0F0F00000000000000000000000000000000000000000003202090000000000000000003B000000B402000000000000000000000000000001000000
(PID) Process:(6344) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_1
Value:
4C000000730100000500000000000000F0F0F0000000000000000000000000000000000000000000640204000000000000000000180000002A00000000000000000000000000000002000000
(PID) Process:(6344) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_2
Value:
4C000000730100000400000000000000F0F0F0000000000000000000000000000000000000000000D80204000000000000000000180000006400000000000000000000000000000003000000
Executable files
16
Suspicious files
12
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
7152more.comC:\Users\admin\AppData\Local\Temp\fvqffhykhgeor
MD5:
SHA256:
1732WinRAR.exeC:\Users\admin\Desktop\#!!SetUp_4433_Pa$WorD!\Set-up.exeexecutable
MD5:537915708FE4E81E18E99D5104B353ED
SHA256:6DC7275F2143D1DE0CA66C487B0F2EBFF3D4C6A79684F03B9619BF23143ECF74
1732WinRAR.exeC:\Users\admin\Desktop\#!!SetUp_4433_Pa$WorD!\msidcrl40.dllexecutable
MD5:99AAF486011BB3251113CC4A3BEB4BA7
SHA256:F2CDD90CECE5D69F2FFBE8C6349F08646DBB942993C8EE4CF44084F220F99ED3
1784Set-up.exeC:\Users\admin\AppData\Roaming\euu\contactsUX.dllexecutable
MD5:54EE6A204238313DC6ACA21C7E036C17
SHA256:0ABF68B8409046A1555D48AC506FD26FDA4B29D8D61E07BC412A4E21DE2782FD
1732WinRAR.exeC:\Users\admin\Desktop\#!!SetUp_4433_Pa$WorD!\yvukbinary
MD5:65BFB05C9DE474C1958E0B4AA0E71CEC
SHA256:DA0C735F265C9C1A5AC5471C62C9FC5BC1130A05A88FAAE049157531F22963AD
1732WinRAR.exeC:\Users\admin\Desktop\#!!SetUp_4433_Pa$WorD!\AdTree.dllexecutable
MD5:530957A391C6BC978AE7179179594B12
SHA256:9FBEAB4BCFCEC34DC13CAD90609101B2EA099069AB173555635F174597E4EA09
1784Set-up.exeC:\Users\admin\AppData\Roaming\euu\msidcrl40.dllexecutable
MD5:99AAF486011BB3251113CC4A3BEB4BA7
SHA256:F2CDD90CECE5D69F2FFBE8C6349F08646DBB942993C8EE4CF44084F220F99ED3
1784Set-up.exeC:\Users\admin\AppData\Roaming\euu\NQZHGQADZVSNGDWOAHOBIOFWN\nc.exeexecutable
MD5:7FB44C5BCA4226D8AAB7398E836807A2
SHA256:A64EAD73C06470BC5C84CFC231B0723D70D29FEC7D385A268BE2C590DC5EB1EF
1784Set-up.exeC:\Users\admin\AppData\Roaming\euu\aktfhbinary
MD5:721AC5A0FC4C15AFA7FCFADC3F56EA88
SHA256:6CF445F695E484C35B252D630B0BA6A13DADEEBD58E9000033753FAF0BBB1CCA
7132nc.exeC:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8061.timestamptext
MD5:212A3664635F8E40F69DB6A91975F216
SHA256:DF45E14814EE56B1B18A62FA4C9C2F11C9450CE937D902876205FE2C99C40AAA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
59
DNS requests
33
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
6164
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
1552
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
6164
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
3600
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
whitelisted
6420
OpenWith.exe
GET
200
172.217.18.99:80
http://c.pki.goog/r/gsr1.crl
unknown
whitelisted
6704
explorer.exe
POST
200
104.21.23.211:80
http://moviecentral-petparade.com/g9jvjfd73/index.php
unknown
malicious
6704
explorer.exe
POST
200
104.21.23.211:80
http://moviecentral-petparade.com/g9jvjfd73/index.php
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1588
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
5488
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6944
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4360
SearchApp.exe
104.126.37.178:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
whitelisted
1552
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 104.126.37.178
  • 104.126.37.170
  • 104.126.37.184
  • 104.126.37.179
  • 104.126.37.163
  • 104.126.37.162
  • 104.126.37.177
  • 104.126.37.185
  • 104.126.37.171
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 142.250.186.46
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.68
  • 40.126.32.76
  • 40.126.32.133
  • 40.126.32.74
  • 40.126.32.138
  • 20.190.160.14
  • 20.190.160.17
whitelisted
th.bing.com
  • 104.126.37.185
  • 104.126.37.171
  • 104.126.37.178
  • 104.126.37.170
  • 104.126.37.184
  • 104.126.37.179
  • 104.126.37.163
  • 104.126.37.162
  • 104.126.37.177
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Domain Observed Used for C2 Detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (creative-habitat .shop)
2172
svchost.exe
Misc activity
ET INFO Pastebin Service Domain in DNS Lookup (rentry .co)
6420
OpenWith.exe
Misc activity
ET INFO Observed Pastebin Service Domain (rentry .co in TLS SNI)
2172
svchost.exe
Domain Observed Used for C2 Detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (creative-habitat .shop)
6704
explorer.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
6704
explorer.exe
Malware Command and Control Activity Detected
BOTNET [ANY.RUN] Amadey HTTP POST Request (st=s)
7 ETPRO signatures available at the full report
No debug info